ABSTRACT 


A method that protects computer data from untrusted programs. Each computer's object 
and process is assigned with trust attributes, which define the way it can interact with other 
objects within the system. The trust attributes are defined hierarchically so that processes cannot 
access objects with higher trust levels than themselves. When accessing objects with lower trust 
levels, processes can see their trust levels lowered to that of the object accessed. The interaction 
between processes and objects of different levels is entirely programmable. 
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